feature: add oidc login flow

scripts/register_oidc_client.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+log() {
+  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
+}
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Required command not found: $1" >&2
+    exit 1
+  fi
+}
+
+require_cmd curl
+require_cmd python3
+
+ISSUER="${SKD_OIDC_ISSUER:-}"
+REG_ENDPOINT_DEFAULT=""
+if [[ -n "${ISSUER}" ]]; then
+  REG_ENDPOINT_DEFAULT="${ISSUER%/}/connect/register"
+fi
+
+REG_ENDPOINT="${OIDC_REGISTRATION_ENDPOINT:-$REG_ENDPOINT_DEFAULT}"
+INITIAL_TOKEN="${OIDC_INITIAL_ACCESS_TOKEN:-}"
+CLIENT_NAME="${OIDC_CLIENT_NAME:-Safe Kiddo Daemon}"
+REDIRECT_URI="${SKD_OIDC_REDIRECT_URI:-http://localhost:8000/login/oidc/callback}"
+
+if [[ -z "${REG_ENDPOINT}" || -z "${INITIAL_TOKEN}" ]]; then
+  cat >&2 <<'EOF'
+Missing configuration. Set:
+  SKD_OIDC_ISSUER (or OIDC_REGISTRATION_ENDPOINT)
+  OIDC_INITIAL_ACCESS_TOKEN
+Optional:
+  OIDC_CLIENT_NAME (default: Safe Kiddo Daemon)
+  SKD_OIDC_REDIRECT_URI (default: http://localhost:8000/login/oidc/callback)
+EOF
+  exit 1
+fi
+
+log "Registering client at ${REG_ENDPOINT} with redirect ${REDIRECT_URI}..."
+
+TMP_RESP="$(mktemp)"
+trap 'rm -f "${TMP_RESP}"' EXIT
+
+HTTP_CODE=$(curl -sS -o "${TMP_RESP}" -w '%{http_code}' \
+  -X POST "${REG_ENDPOINT}" \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer ${INITIAL_TOKEN}" \
+  -d "{\"client_name\":\"${CLIENT_NAME}\",\"redirect_uris\":[\"${REDIRECT_URI}\"]}")
+
+if [[ "${HTTP_CODE}" != "200" && "${HTTP_CODE}" != "201" ]]; then
+  echo "Client registration failed (HTTP ${HTTP_CODE}):" >&2
+  cat "${TMP_RESP}" >&2
+  exit 1
+fi
+
+python3 - "$TMP_RESP" <<'PYCODE'
+import json, sys
+path = sys.argv[1]
+data = json.load(open(path, "r"))
+client_id = data.get("client_id")
+client_secret = data.get("client_secret")
+print("Client registered.")
+if client_id:
+    print(f"Client ID: {client_id}")
+if client_secret:
+    print(f"Client Secret: {client_secret}")
+if not (client_id and client_secret):
+    print("Warning: Response missing client_id or client_secret", file=sys.stderr)
+PYCODE